SURYASECURITY ARCHITECTURE

PROJECT-06 / Azure security architecture

AZ-02 — Azure Cloud Security Architecture Review & Controlled Remediation Lab

A bounded Azure cloud-security architecture assessment and controlled remediation lab covering governance, identity, network and private access, logging, workload authentication, residual risk, secure teardown, MCSB traceability, and multicloud architecture mapping.

State
Validated
Platform
Microsoft Azure / Microsoft Entra ID
View Source RepositoryBack to Projects

01 /Security Objective

Assess an intentionally imperfect Azure environment, identify architecture and control gaps, implement selected remediations, validate outcomes, reassess residual risk, and complete controlled teardown.

Category: Azure security architecture

02 /Architecture Overview

Hub/spoke Azure lab with Azure Firewall, Container Apps, Storage, Key Vault, Azure Policy, Microsoft Entra identity, Azure RBAC, Private Endpoint/Private DNS, Log Analytics, and Defender for Cloud posture capabilities.

Platform scope

  • Microsoft Azure
  • Microsoft Entra ID

CONTROL /Controls in Scope

  • Azure Policy
  • Azure RBAC
  • Managed Identity
  • Azure Firewall
  • Private Endpoint
  • Private DNS
  • Azure Key Vault
  • Azure Storage
  • Log Analytics
  • Microsoft Defender for Cloud
  • Container Apps Authentication

03 /Implementation Record

Selected remediations included resource-group Azure Policy guardrails, managed-identity privilege reduction, Storage and Key Vault private access, Key Vault audit logging, workload authentication, and documented network segmentation/inspection configuration.

Delivery
Evidence-driven assessment, controlled remediation, validation, residual-risk analysis, and documented teardown

04 /Validation Record

Validation method
Evidence included controlled policy denial, authenticated/unauthenticated access checks, private-path reachability, audit-log queries, current-state revalidation, residual-risk reassessment, and scoped teardown verification.
Evidence record
Architecture review, risk register, controlled validation, remediation evidence, residual-risk assessment, cleanup verification, MCSB traceability, and multicloud architectural mapping

WORKFLOW /Engineering Lifecycle

  1. 01Assessment
  2. 02Architecture Review
  3. 03Risk Identification
  4. 04Control Gap Analysis
  5. 05Target-State Design
  6. 06Implement
  7. 07Validate
  8. 08Controlled Failure
  9. 09Investigate
  10. 10Remediate
  11. 11Revalidate
  12. 12Residual Risk
  13. 13Roadmap
  14. 14Cleanup
  15. 15DevSecOps Design
  16. 16MCSB Mapping
  17. 17Multicloud Mapping
  18. 18Closeout

05 /Current State & Limitations

Validated

Runtime Azure Firewall traversal and effective packet-path behavior were not proven. R-003 remains Open with residual risk Not assessed; R-010 remains Open at 9 — Medium. No successful Key Vault secret retrieval or Storage Blob data operation was proven; Storage private endpoint coverage was Blob only. Inherited permissions were not exhaustively assessed, granular application authorization was not implemented, and foundational CSPM did not represent full Defender workload protection. Project completion does not imply production readiness or compliance.

View Source Repository